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Amendments to the Claims: 

This listing of claims will replace all prior versions, and listings, of claims in the application: 
Listing of Claims: 

1. (Previously Presented) A system for detecting the presence of an observing program on a 
computer system, the system comprising: 

a computer system comprising a processor, memory, a user input device and a monitor, 
wherein the memory comprises: 

observer data that includes data descriptive of an observer program, the observer 
program being programmed to observe a user's activities on the computer 
system by monitoring user input entered through a user input device and 
also operating to create a log file from the observing of the observer 
program; 

accessing instructions that access the observer data; 

reading instructions that read the memory of the computer system to obtain 
memory data; 

comparing instructions that compare the observer data with memory data read in 

from the memory to determine whether the observer program is present on 

the computer system; 
generating instructions that generate results from the comparing, wherein the 

results generated indicate whether the observer program is present on the 

computer system; 

countermeasure instructions that alter the operation of the observer program; and 
outputting instructions that obtain the results and provide the results for a user and 

that prompt the user as to whether the countermeasure instructions should 

be executed. 
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2. (Original) The system of claim 1 wherein the reading instructions read the memory of the 
computer system by querying the operating system of the computer system for the tasks running and 
by examining task information provided by the operating system. 

3. (Original) The system of claim 1 wherein the outputting instructions provide the results to a 
user through a graphical user interface. 

4. (Original) The system of claim 1 wherein the reading instructions read the memory of the 
computer system by querying the file system of the computer system for the files located on storage 
media and by examining file information provided by the file system. 

5. (Original) The system of claim 1 wherein the reading instructions read the memory of the 
computer system by opening a file located on storage media and by examining contents of the file. 

6. (Original) The system of claim 1 wherein the observer data includes data descriptive of a 
plurality of observer programs and wherein the system compares the observer data with the memory 
data to determine whether any known observer program is present. 

7. (Canceled) 

8. (Previously Presented) The system of claim 1 wherein the countermeasure instructions alter 
the operation of the observer program by altering observer program configuration data. 

9. (Previously Presented) The system of claim 1 wherein the countermeasure instructions 
alter the operation of the observer program by altering a file on the computer system, and 
wherein the countermeasure instructions are executable to (1) temporarily disable the observer 
program, (2) permanently disable the observer program, and (3) create decoy observer created 
data but wherein the observer program continues running. 
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10. (Previously Presented) The system of claim 1 wherein the countermeasure instructions alter 
the operation of the observer program by altering reporting data generated by the observer program. 

1 1 . (Previously Presented) The system of claim 1 wherein the countermeasure instructions alter 
the operation of the observer program by replacing reporting data generated by the observer program 
but wherein the observer program continues running. 

12. (Previously Presented) The system of claim 1 wherein the countermeasure instructions alter 
the operation of the observer program by replacing a file of the observer program. 

13. (Original) The system of claim 1 wherein the observer data includes data descriptive of 
observing activity typical of observing programs and wherein the system compares the observer data 
with the memory data to determine whether any known observer program is present. 

14. (Original) The system of claim 1 further comprising the observer data, wherein the observer 
data includes a list of files and modules that are part of the observer program software, and wherein 
the reading instructions read the memory of the computer system by querying the operating system of 
the computer system for the tasks running and by examining task information provided by the 
operating system, and wherein the reading instructions also read the memory of the computer system 
by querying the file system of the computer system for the files located on storage media and by 
examining file information provided by the file system, and wherein the outputting instructions 
provide the results to a user through a graphical user interface. 

15. (Original) The system of claim 1 wherein the system is made available over a computer 
network through a web site. 

16. (Previously Presented) A system for detecting the presence of an observing program on a 
computer system, the system comprising: 

a computer system comprising a processor, memory, a user input device and a monitor, 



Page 4 of 11 



Appl. No. 09/491,727 

Amdt. dated July 28, 2011 

Reply to Office Action of April 28, 201 1 

wherein the memory comprises: 

observer data that includes data descriptive of an observer program, the observer 
program being programmed to observe a user's activities on the computer 
system by monitoring user input entered through a user input device and also 
operating to create a log file from the observing of the observer program; 

means for accessing the observer data; 

means for reading the memory of the computer system to obtain memory data; 
means for comparing the observer data with memory data to determine whether the 

observer program is present on the computer system; 
means for generating results from the comparison, wherein the results generated 

indicate whether the observer program is present on the computer system; 
means for altering the operation of the observer program; and 

means for outputting the results for a user and for prompting the user as to whether 
the countermeasure instructions should be executed. 

17. (Previously Presented) A method for detecting the presence of an observing program on a 
computer system, wherein the observing program is programmed to observe a user's activities on the 
computer system by monitoring user input entered through a user input device and to create data from 
the observing on the computer system, the method being implemented through computer software for 
running on the computer system, the method comprising the steps of: 

accessing observer data, the observer data including data descriptive of an observer program, 
the observer program being programmed to observe a user's activities on the computer 
system by monitoring user input entered through a user input device and also 
operating to create a log file from the observing of the observer program; 
reading memory of the computer system to obtain memory data; 

comparing the observer data with memory data read in from memory to determine whether the 
observer program is present on the computer system; 
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generating results from the reading and comparing, wherein the results generated indicate 

whether the observer program is present on the computer system; 
outputting the results for a user; and 

prompting the user as to whether countermeasure instructions should be executed, 

wherein the countermeasure instructions are executable to (1) temporarily disable 
the observer program, (2) permanently disable the observer program, and (3) 
create decoy observer created data but wherein the observer program continues 
running. 



18. (Currently Amended) An article of manufacture comprising: 

a tangible non-transitory computer-readable storage medium containing instructions for 

detecting the presence of an observing program on a computer system, wherein the 
instructions are executable to: 
access observer data, the observer data including data descriptive of an observer program, the 
observer program being programmed to observe a user's activities on the computer 
system by monitoring user input entered through a user input device and also 
operating to create a log file from the observing of the observer program; 
read memory of the computer system to obtain memory data; 

compare the observer data with memory data read in from memory to determine whether the 

observer program is present on the computer system; 
generate results from the read and compare, wherein the results generated indicate whether the 

observer program is present on the computer system; 
output the results for a user; and 

prompt the user as to whether countermeasure instructions should be executed, wherein 
the countermeasure instructions are executable to (1) temporarily disable the 
observer program, (2) permanently disable the observer program, and (3) create 
decoy observer created data but wherein the observer program continues running. 



19. (Cancelled) 
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20. (Withdrawn) A system for altering the operation of an observer program on a computer 
system, wherein the observing program is programmed to observe a user's activities on the computer 
system by monitoring user input entered through a user input device and to create data from the 
observing on the computer system, the system including computer software for running on the 
computer system, the system comprising: 

observer data that includes data descriptive of an observer program, the observer program 

being programmed to observe a user's activities on the computer system by monitoring 
user input entered through a user input device and also operating to create a log file 
from the observing of the observer program; 

accessing instructions that access the observer data; 

reading instructions that read memory of the computer system to obtain files relating to the 
observer program; 

altering instructions that alter a file relating to the observer program such that the operation of 
the observer program is changed. 

21. (Withdrawn) The system of claim 20 further comprising an observer detection program. 

22. (Withdrawn) The system of claim 20 further comprising inputting instructions that display to 
a user options regarding the altering and that take input from the user relating to the options. 

23. (Withdrawn) The system of claim 20 wherein the altering instructions alter the operation of 
the observer program by altering observer program configuration data. 

24. (Withdrawn) The system of claim 20 wherein the altering instructions alter the operation of 
the observer program by altering a file on the computer system. 

25. (Withdrawn) The system of claim 20 wherein the altering instructions alter the operation of 
the observer program by altering reporting data generated by the observer program. 
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26. (Withdrawn) The system of claim 20 wherein the altering instructions alter the operation of 
the observer program by replacing reporting data generated by the observer program. 

27. (Withdrawn) The system of claim 20 wherein the altering instructions alter the operation of 
the observer program by replacing a file of the observer program. 

28. (Withdrawn) The system of claim 20 wherein the system is made available over a computer 
network through a web site. 

29. (Withdrawn) A system for altering the operation of an observer program on a computer 
system, wherein the observing program is programmed to observe a user's activities on the computer 
system by monitoring user input entered through a user input device and to create data from the 
observing on the computer system, the system including computer software for running on the 
computer system, the system comprising: 

observer data that includes data descriptive of an observer program, the observer program 

being programmed to observe a user's activities on the computer system by monitoring 
user input entered through a user input device and also operating to create a log file 
from the observing of the observer program; 

means for accessing the observer data; 

means for reading memory of the computer system to obtain files relating to the observer 
program; and 

means for altering a file relating to the observer program such that the operation of the 
observer program is changed. 

30. (Withdrawn) A method for altering the operation of an observer program on a computer 
system, wherein the observing program is programmed to observe a user's activities on the computer 
system by monitoring user input entered through a user input device and to create data from the 
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observing on the computer system, the method being implemented through computer software for 
running on the computer system, the method comprising the steps of: 

accessing observer data, the observer data including data descriptive of the observer program, 
the observer program being programmed to observe a user's activities on the computer 
system by monitoring user input entered through a user input device and also 
operating to create a log file from the observing of the observer program; 
reading memory of the computer system to obtain files relating to the observer program; and 
altering a file relating to the observer program such that the operation of the observer program 
is changed. 

3 1 . (Withdrawn) A computer-readable medium containing instructions for altering the operation 
of an observer program on a computer system, wherein the observing program is programmed to 
observe a user's activities on the computer system by monitoring user input entered through a user 
input device and to create data from the observing on the computer system, wherein the instructions 
comprise executable instructions for implementing a method comprised of the steps of: 

accessing observer data, the observer data including data descriptive of the observer program, 
the observer program being programmed to observe a user's activities on the computer 
system by monitoring user input entered through a user input device and also 
operating to create a log file from the observing of the observer program; 
reading memory of the computer system to obtain files relating to the observer program; and 
altering a file relating to the observer program such that the operation of the observer program 
is changed. 

32. (Withdrawn) The computer-readable medium of claim 31 wherein the computer-readable 
medium is a data transmission medium. 
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